Security audit

OADP Agent Discovery

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent protocol-discovery documentation, but it includes an unpinned npm execution command and overstates its active authentication model.

Install only if you are comfortable with a skill that performs public web discovery and can optionally share agent profile or discovered-hub data with manually configured trusted hubs. Do not run the `npx oadp-discovery` command unless you pin and review the package or execute it in a sandbox. Treat the mutual-authentication claim as overstated unless you add your own pinned-key, signed-request, or mTLS controls.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:169
Finding: Active Network Operations Lack the Claimed Mutual Authentication
Content: View full analysis
/ping" \ -H "Content-Type: application/json" \ -d '{"ping": true}' # Privacy level: minimal — light introduction curl -s -X POST "/ping" \ -H "Content-Type: application/json" \ -d '{ "name": "YOUR_AGENT_NAME", "orchestrator": "openclaw", "signal_layer": "well-known" }' # Privacy level: full — complete profile curl -s -X POST "/ping" \ -H "Content-Type: application/json" \ -d '{ "name": "YOUR_AGENT_NAME", "orchestrator": "openclaw", "capabilities": ["research", "code"], "signal_layer": "well-known" }' ``` Federation similarly sends discovered hub information without documented mutual authentication: ```bash curl -s -X POST "/federation/report" \ -H "Content-Type: application/json" \ -d '{"hub_url": "https://newly-discovered-hub.com/api", "signal_layer": "header"}' ``` The only additional authentication mechanism described is optional PONG signature verification: ```text If a hub provides a `public_key` in its `/.well-known/agent-protocol.json` and a `signature` in its PONG response, verify that the response is authentic: 1. Extract `signature` from PONG response 2. Fetch `public_key` from `/.well-known/agent-protocol.json` (cache it) 3. Verify the signature covers the PONG body (minus the `signature` field) 4. If v ...[truncated 2982 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:286
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
|-------|--------|-------| | HTTP Header | `X-Agent-Protocol: oadp/1.0` | Any HTTP response | | Well-Known | `/.well-known/agent-protocol.json` | Domain root | | Markdown | `` | Any .md file | | HTML Meta | `<meta name="agent-protocol" content="oadp/1.0">` | Any web page | | robots.txt | `# OADP/1.0` + `# Agent-Hub: <url>` | Domain root | | DNS TXT | `_agent.<domain>` record | Domain DNS |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
bash
# Privacy level: anonymous (default) — reveals nothing curl -s -X POST "<trusted_hub_url>/ping" \ -H "Content-Type: application/json" \ -d '{"ping": true}'

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.